JP2011257901A - Analysis system, analyzer, analysis method and analysis program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To analyze the behavior of malware which requires a response from a network with safety.SOLUTION: In an analysis system including an analyzer which analyses the behavior of an illegal program and a database which stores information on a connection destination connected to a network, an execution means which executes an illegal program which performs an illegal operation in a computer. A determination means makes an inquiry about information on a connection destination to which the illegal program executed by the execution means requests for a connection to the database, and determines whether or not the connection destination is a connection destination with permission for communication based on the result of the inquiry. A response processing means communicates with the connection destination and receives a response to the illegal program if it was determined that the connection destination is the connection destination with permission for communication by the determination means.

Description

  The present invention relates to an analysis system, an analysis apparatus, an analysis method, and an analysis program.

  Conventionally, unauthorized computer programs such as computer viruses and spyware are known. Such malicious programs are also called malware. In recent years, various analyzes relating to malware have been performed in order to reduce damage caused by malware.

  For example, when a computer is infected with malware, an analysis for examining what kind of communication is generated or what effect is exerted on the internal resources of the computer is performed. The internal resources are, for example, a nonvolatile storage medium, a volatile storage medium, and data stored by these storage media. As a method for executing the analysis as described above, for example, a dynamic analysis method for analyzing behavior by actually operating malware in a computer is known.

JP 2009-181335 A

Konstantin Rozinov “REVERSE CODE ENGINEERING: An In-Depth Analysis of the Bagle Virus” Lucent Technologies

Mark Vincent Yason “The Art of Unpacking” Black Hat USA 2007 Briefings

  However, the above-described conventional technology has a problem that it is not possible to safely analyze the behavior of malware that requires a response from the network.

  Specifically, the above-described prior art is executed in an environment where a computer is isolated from a network in order to ensure safety. However, some malware poses a threat in an environment where computers are connected to a network. For example, as the above-mentioned malware, there are known “bots” that make threats manifest by receiving instructions from attackers that exist on the network, “downloaders” that download other malware from the network, etc. Yes.

  Even if such a malware is analyzed in an environment where the computer is isolated from the network, it is difficult to obtain a good analysis result. Therefore, it is desirable to execute a dynamic analysis method for analyzing behavior in an environment where a computer is connected to a network. However, when the dynamic analysis method is executed in an environment where the computer is connected to the network, not only communication with malicious connections including attackers and other malware existing on the network, Communication with a regular connection destination is permitted. For example, the analysis target malware may attack other legitimate connection destinations connected to the network. In other words, the above-described conventional technology cannot safely analyze the behavior of malware that requires a response from the network.

  In view of the above-described problems of the prior art, the technology of the present disclosure provides an analysis system, an analysis device, an analysis method, and an analysis program that can safely analyze the behavior of malware that requires a response from the network. The purpose is to do.

  In order to solve the above-described problems and achieve the object, the disclosed system is an analysis system including an analysis device that analyzes the behavior of a malicious program, and a database that stores information about connection destinations connected to a network. The execution means in the analysis device executes an illegal program that performs an illegal operation in the computer. Then, the determination means inquires of the database about information on the connection destination to which the unauthorized program executed by the execution means requests connection, and whether or not the connection destination is a connection destination permitted to communicate based on the result of the inquiry. judge. When the response processing unit determines that the connection destination is a connection destination permitted to communicate, the response processing unit communicates with the connection destination to obtain a response to the malicious program.

  The disclosed system makes it possible to safely analyze the behavior of malware that requires a response from the network.

FIG. 1 is a diagram illustrating an example of the configuration of the analysis system according to the first embodiment. FIG. 2 is a diagram illustrating an example of data stored in the permission list storage unit. FIG. 3 is a diagram schematically illustrating an example of a search by the search server. FIG. 4 is a diagram schematically illustrating an example of a link search performed by the search server. FIG. 5 is a diagram illustrating an example of processing performed by the response processing unit when the connection destination is a connection destination permitted to communicate. FIG. 6 is a diagram illustrating an example of processing performed by the response processing unit when the connection destination is a connection destination that is not permitted to communicate. FIG. 7 is a flowchart of the determination process performed by the analysis system according to the first embodiment. FIG. 8 is a flowchart of a response process performed by the analysis system according to the first embodiment. FIG. 9 is a diagram showing a modification. FIG. 10 is a diagram illustrating a computer that executes an analysis program.

  Exemplary embodiments of an analysis system, an analysis method, and an analysis program disclosed in the present application will be described below in detail with reference to the accompanying drawings. The analysis system, the analysis method, and the analysis program disclosed in the present application are not limited to the following examples.

  The analysis system according to the first embodiment determines whether the connection destination requested by the malicious program is a malicious connection destination or a regular connection destination. In the analysis system according to the first embodiment, when the connection destination is a malicious connection destination, the behavior of the malicious program that requires a response from the network by communicating with the connection destination and acquiring a response to the malicious program. Is analyzed. The malicious program is, for example, a computer virus or spyware. In the following, a malicious program may be described as malware. The malignant connection destination is, for example, a host that stores malware downloaded by a downloader or a host that stores an instruction for malware by an attacker. On the other hand, the legitimate connection destination is a host that does not store malware downloaded by the downloader or instructions for the malware.

  Specifically, the analysis system according to the first embodiment is an analysis system that includes an analysis device that analyzes the behavior of a malicious program and a database that stores information about connection destinations connected to a network. The analysis system according to the first embodiment executes an unauthorized program that performs an unauthorized operation in a computer. Then, the analysis system according to the first embodiment inquires of the database about information on a connection destination to which the executed malicious program requests connection, and based on the result of the inquiry, whether or not the connection destination is a connection destination permitted to communicate. Determine whether. When the analysis system according to the first embodiment determines that the connection destination is a connection destination permitted to communicate, the analysis system communicates with the connection destination to obtain a response to the malicious program.

  Therefore, the analysis system according to the first embodiment can perform communication only with a malignant connection destination without specifying communication with a normal connection destination by specifying a malignant connection destination on the network. That is, according to the analysis system according to the first embodiment, for example, malware behavior analysis that communicates with a malignant connection destination while preventing malware from attacking a regular connection destination connected to the network is performed. It is possible to safely analyze the behavior of malware that requires a response from the network. For example, according to the analysis system according to the first embodiment, malware that receives an instruction from an attacker or downloads other malware using HTTP (Hypertext Transfer Protocol), which is a protocol normally used on the Internet. Can be safely analyzed.

[Configuration of Analysis System According to Example 1]
A configuration of the analysis system 400 according to the first embodiment will be described. FIG. 1 is a diagram illustrating an example of a configuration of an analysis system 400 according to the first embodiment. As shown in FIG. 1, the analysis system 400 includes an analysis device 100 that analyzes the behavior of malware, and a search server 200 that has a database that stores information related to connection destinations connected to the network 300. In the analysis system 400, the analysis apparatus 100 and the search server 200 are connected to the connection destinations 101 to 103 via the network 300. The connection destinations 101 to 103 are communication connection destinations requested by malware executed in the analysis apparatus 100. For example, the connection destinations 101 to 103 are a predetermined host connected to the network 300 or predetermined contents stored in the host. For example, the connection destinations 101 to 103 are malignant or legitimate hosts and contents.

  As illustrated in FIG. 1, the search server 200 includes a communication control I / F unit 210, a database 220, and a processing unit 230. The communication control I / F unit 210 is an interface that controls communication between the analysis apparatus 100 and the search server 200. The database 220 stores data for search engines executed by the processing unit 230. The processing unit 230 executes a command issued by the analysis apparatus 100 described later. For example, the processing unit 230 searches the search engine to determine whether or not the connection destination designated from the analysis apparatus 100 described later is stored in the database 220. The processing by the search server 200 will be described in detail later.

  As shown in FIG. 1, the analysis apparatus 100 includes an input / output control I / F unit 10, an input unit 20, a display unit 30, a communication unit 40, an analysis data storage unit 51, and a permission list storage unit 52. , A data processing unit 61, a malware execution unit 62, a connection determination unit 63, and a response processing unit 64. The analysis device 100 is, for example, a PC (Personal computer), a workstation, or a dedicated device for analysis. The analysis data storage unit 51 and the permission list storage unit 52 are, for example, semiconductor memory elements such as a RAM (Random Access Memory) and a flash memory, or storage devices such as a hard disk and an optical disk. The data processing unit 61, the malware execution unit 62, the connection determination unit 63, and the response processing unit 64 are, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), or a CPU (Central An electronic circuit such as a processing unit (MPU) or a micro processing unit (MPU). In FIG. 1, three connection destinations and one search server are shown, but actually, a larger number of connection destinations and search servers are connected to the analysis apparatus 100 via the network 300. .

  The input / output control I / F unit 10 is an interface that controls the exchange of various information among the input unit 20, the display unit 30, the communication unit 40, the connection determination unit 63, and the response processing unit 64. The input unit 20 receives, for example, various information input processes by an analyst. For example, the input unit 20 is a keyboard, a touch panel, or the like. For example, the display unit 30 displays and outputs the analysis result to the analyst. For example, the display unit 30 is a display.

  The communication unit 40 controls communication between the analysis device 100 and the connection destinations 101 to 103 and between the analysis device 100 and the search server 200. The analysis data storage unit 51 stores malware information analyzed by the analysis device 100. For example, the analysis data storage unit 51 stores the type and behavior of malware.

  The permission list storage unit 52 stores information on connection destinations whose communication is permitted in advance as a target of malware operation. Specifically, the permission list storage unit 52 stores a permission list that is information on connection destinations that an analyst inputs in advance via the input unit 20 or communication is permitted in the past analysis. FIG. 2 is a diagram illustrating an example of data stored in the permission list storage unit 52.

  As shown in FIG. 2, the permission list storage unit 52 stores a permission list including a host name and an IP (Internet Protocol) address. Here, the host name in FIG. 2 means an FQDN (Fully Qualified Domain Name) of a host connected to the network 300. Also, the IP address shown in FIG. 2 means the IP address of a host connected to the network 300. For example, the permission list storage unit 52 stores “host names: aaa.bbb.ccc.com, ddd.eeee.fff.com” as shown in FIG. Further, as shown in FIG. 2, the permission list storage unit 52 stores “IP address: 111.222.333.444, 555.6666.777.888”.

  Returning to FIG. 1, the data processing unit 61 stores the malware information analyzed by the analysis device 100 in the analysis data storage unit 51 or displays the analysis result on the display unit 30. The malware execution unit 62 executes malware that performs an illegal operation in the computer. Specifically, the malware execution unit 62 causes the analysis target malware input by an analyst or acquired from the network to execute an operation, and performs various types of information requested by the executed malware, which will be described later. The data is transferred to the unit 64. For example, the malware execution unit 62 transfers “FQDN: www.malware.com” to the response processing unit 64 as information on the connection destination 102 requested by the executed malware.

  When the information related to the connection destination requested by the malware is stored in the permission list storage unit 52, the connection determination unit 63 determines that the connection destination is a connection destination for which communication is permitted. In addition, the connection determination unit 63 inquires the database 220 about information on a connection destination to which the malware executed by the malware execution unit 62 requests connection, and based on the result of the inquiry, the connection destination is a connection destination that is permitted to communicate. It is determined whether or not there is. Specifically, the connection determination unit 63 inquires of the database 220 using the connection destination IP address or FQDN as the connection destination information, and if the IP address or FQDN is not stored in the database 220, the connection determination unit 63 determines the connection destination. It is determined that the connection destination is permitted to communicate. In addition, when the connection destination IP address or FQDN is stored in the database 220, the connection determination unit 63 further inquires the database 220 of the number of other connection destinations that form a link to the connection destination. When the number of other connection destinations is equal to or less than a predetermined threshold, the connection destination is determined to be a connection destination permitted to communicate. Furthermore, the connection determination unit 63 stores information on the connection destination in the database 220, and when the number of other connection destinations forming a link at the connection destination exceeds a predetermined threshold, The connection destination is determined as a connection destination for which communication is not permitted.

  More specifically, when the connection determination unit 63 receives information of a connection destination requested by the malware executed by the malware execution unit 62 via the response processing unit 64 described later, first, the received information is permitted. It is determined whether or not it is stored by the list storage unit 52. For example, the connection determination unit 63 determines whether or not “FQDN: www.malware.com” of the connection destination 102 received from the response processing unit 64 is included in the permission list shown in FIG.

  Here, when the information on the connection destination requested by the malware is included in the permission list, the connection determination unit 63 determines that the connection destination requested by the malware is the connection destination permitted to communicate. . For example, when “FQDN: www.malware.com” is included in the permission list, the connection determination unit 63 determines the connection destination 102 as a connection destination for which communication is permitted.

  On the other hand, when the connection destination information requested by the malware is not included in the permission list, the connection determination unit 63 transmits the connection destination information to the search server 200. Then, the connection determination unit 63 causes the search server 200 to search whether or not the transmitted connection destination information is stored in the database 220. For example, if “FQDN: www.malware.com” is not included in the permission list, the connection determination unit 63 transmits “www.malware.com” to the search server 200. Then, the connection determination unit 63 causes the search server 200 to execute a search for “www.malware.com”.

  FIG. 3 is a diagram schematically illustrating an example of a search performed by the search server 200. FIG. 3 shows a search result obtained when the search server 200 performs a site search of “www.malware.com”. For example, as shown in FIG. 3, the search server 200 performs a site search of “www.malware.com” and searches that “site: www.malware.com could not be found”. Get results. Then, the search server 200 transmits the obtained search result to the connection determination unit 63. In FIG. 3, a site search using a search engine executed in the search server 200 is shown as a search site “AAA”. FIG. 3 shows an example of the case where a GUI (Graphical User Interface) provided by the search server is used, but the API (Application Program Interface) provided by the search server is used without using the GUI. The connection destination information may be inquired, and the result may be received in a format such as XML (Extensible Markup Language).

  Then, if the connection destination information is not stored in the database 220, the connection determination unit 63 determines the connection destination as a connection destination for which communication is permitted. For example, as illustrated in FIG. 3, when the connection destination that matches “www.malware.com” is not stored in the database 220, the connection determination unit 63 connects the connection destination 102 to which communication is permitted. It is determined that it is ahead.

  The determination of the connection destination using this search engine uses characteristics that the regular connection destination and the malignant connection destination give to the database of the search engine. Here, characteristics of the regular connection destination and the malignant connection destination given to the database will be described.

  First, access to a network that is confirmed when malware is executed includes access to a regular connection destination and access to a malicious connection destination. For example, access to a legitimate connection destination is executed to check whether the malware is operating in the analysis environment, that is, to check the connection or to carry out the attack by the malware. When malware uses a legitimate connection destination for connection confirmation, a famous connection destination is frequently used. Therefore, by using the search engine for the determination, there is a high possibility that the legitimate connection destination that the malware is trying to access hits. Further, when malware tries to attack a legitimate connection destination, a search engine is frequently used to select an attack target. Therefore, it is possible to search for a legitimate connection destination to be attacked with a search engine.

  On the other hand, access to a malicious connection destination is executed to receive a command from an attacker or to download another malware. Here, since a malignant connection destination is rarely linked from other connection destinations, it takes time to be registered in the database of the search engine. Or, the malicious connection destination is not registered in the database. That is, there is a high possibility that the regular connection destination is registered in the database for the search engine. On the other hand, it is unlikely that a malicious connection destination is registered in a search engine database. Therefore, the analysis system 400 according to the first embodiment performs communication with a regular connection destination by permitting communication when a connection destination that matches the connection destination with which the malware tries to communicate is not registered in the database 220. It is possible to execute communication only with a malicious connection destination. For example, the analysis system 400 according to the first embodiment executes only communication with a malignant host or communication with a malignant content without performing communication with a normal host or communication with a normal content.

  Here, if the connection destination information is stored in the database 220, the connection determination unit 63 performs the following determination process. Specifically, the connection determination unit 63 causes the search server 200 to search for the number of linked links at the connection destination. That is, the connection determination unit 63 causes the search server 200 to search how much the connection destination is linked from other connection destinations. And the connection determination part 63 determines with it being the connection destination where communication was permitted, when the number of linked links of a connection destination is below a predetermined threshold value.

  FIG. 4 is a diagram schematically illustrating an example of a link search performed by the search server 200. FIG. 4 shows a search result obtained when the search server 200 performs a link search of “www.malware.com”. The search site in FIG. 4 means a search engine used by the search server 200. Further, the number of linked links in FIG. 4 means the number of other contents linked to the connection destination. For example, as shown in FIG. 4, the search server 200 executes a link search of “www.malware.com” and obtains a search result “search site: AAA, number of linked links: 2”. Then, the search server 200 transmits the obtained search result to the connection determination unit 63.

  When receiving the search result, the connection determination unit 63 determines whether or not the number of linked links is equal to or less than a predetermined threshold. And the connection determination part 63 determines a connection destination as the connection destination where communication was permitted, when the number of to-be-linked links is below a predetermined threshold value. For example, when the predetermined threshold value is “5”, the number of links in the search result shown in FIG. 4 is “2”, so the connection determination unit 63 indicates “www.malware.com”. It is determined that the connection destination 102 is a connection destination for which communication is permitted. On the other hand, if the number of linked links exceeds a predetermined threshold, the connection determination unit 63 determines that the connection destination is a connection destination for which communication is not permitted.

  In the determination using the number of links, the characteristics that the regular connection destination and the malignant connection destination give to the database of the search engine are used. Specifically, there are many other connection destinations that establish links to regular connection destinations, while there are few other connection destinations that establish links to malicious connection destinations. Therefore, the number of linked destinations of malignant connection destinations is extremely small compared to regular connection destinations. In the present embodiment, such a feature is used to determine whether the connection destination is a regular connection or a malignant connection.

  Returning to FIG. 1, when the connection determination unit 63 determines that the connection destination is a connection destination permitted to communicate, the response processing unit 64 communicates with the connection destination and acquires a response to the malware. . If the connection determination unit 63 determines that the connection destination is a connection destination that is not permitted to communicate, the response processing unit 64 generates a response to the malware and transfers the generated response to the malware.

  Specifically, the response processing unit 64 performs communication with the connection destination requested by the malware executed by the malware execution unit 62 when it is determined that the connection destination is the connection destination permitted to communicate. Execute data transmission / reception with the connection destination. FIG. 5 is a diagram illustrating an example of processing performed by the response processing unit 64 when the connection destination is a connection destination permitted to communicate. FIG. 5 illustrates processing by the response processing unit 64 when the connection determination unit 63 determines that the connection destination 102 requested to be connected by malware is a connection destination that permits communication. As illustrated in FIG. 5, when it is determined that the connection destination 102 is a connection destination that permits communication, the response processing unit 64 generates communication data “of malware generated by the malware executed by the malware execution unit 62“ 0010101110 "is transmitted to the connection destination 102. The response processing unit 64 receives the response data “1100111110” generated by the connection destination 102 as a response to the communication data of the malware. Then, the response processing unit 64 transfers the received response data “1100111110” to the malware execution unit 62.

  On the other hand, when it is determined that the connection destination is a connection destination that does not permit communication, the response processing unit 64 does not communicate with the connection destination requested by the malware executed by the malware execution unit 62. Here, the response processing unit 64 generates a response to the malware and transmits the generated data to the malware execution unit 62. FIG. 6 is a diagram illustrating an example of processing by the response processing unit 64 when the connection destination is a connection destination that does not permit communication. FIG. 6 illustrates processing by the response processing unit 64 when the connection determination unit 63 determines that the connection destination 103 requested to be connected by malware is a connection destination that does not permit communication. As illustrated in FIG. 6, when it is determined that the connection destination 103 is a connection destination that does not permit communication, the response processing unit 64 sets dummy data for the malware communication data “1110100001” received from the malware execution unit 62. Response data “1010110101” is generated. Then, the response processing unit 64 transmits the generated response data “1010110101” to the malware execution unit 62.

  In the above-described first embodiment, the case where the FQDN is used for the search for determining the connection destination has been described. However, the present embodiment is not limited to this, for example, the case where the IP address is used. May be. Moreover, the case where the domain name acquired by inquiring a DNS (Domain Name System) server about the IP address received from the malware may be used. Moreover, the case where the IP address acquired by inquiring a DNS (Domain Name System) server about FQDN received from the malware may be used.

[Procedure of determination processing by analysis system according to embodiment 1]
Next, a procedure of determination processing by the analysis system 400 according to the first embodiment will be described. FIG. 7 is a flowchart illustrating a procedure of determination processing by the analysis system 400 according to the first embodiment. As illustrated in FIG. 7, in the analysis system 400 according to the first embodiment, when the connection determination unit 63 receives a connection destination IP address or FQDN (Yes in step S101), the received connection destination IP address or FQDN is permitted. It is determined whether it is included in the list (step S102).

  Here, when the IP address or FQDN of the connection destination is not included in the permission list (No at Step S102), the connection determination unit 63 inquires the search engine (Step S103), and whether or not a matching connection destination is found. Is determined (step S104). Specifically, the connection determination unit 63 causes the search server 200 to search for a connection destination IP address or FQDN, and whether the same host as the connection destination IP address or FQDN is stored in the database 220. Determine whether or not.

  If a matching connection destination is found (Yes at Step S104), the connection determination unit 63 determines whether or not the number of linked hosts of the connection destination host is larger than a predetermined value (Step S105). . Here, when the number of linked hosts of the connection destination host is larger than a predetermined value (Yes at Step S105), the connection determination unit 63 determines that the connection destination does not permit communication (Step S106), and performs processing. finish. That is, the connection determination unit 63 determines that the connection destination is a regular connection destination and ends the process.

  On the other hand, when the IP address or FQDN of the connection destination is included in the allow list (Yes at Step S102), when the connection destination matching the connection destination is not found (No at Step S104), and the number of linked hosts of the connection destination host Is equal to or less than the predetermined value (No at Step S105), the connection determination unit 63 determines that the connection is permitted for communication (Step S107), and ends the process. That is, the connection determination unit 63 determines that the connection destination is a malignant connection destination and ends the process. Note that the connection determination unit 63 is in a standby state until a connection destination IP address or FQDN is received (No in step S101).

[Procedure for response processing by analysis system according to embodiment 1]
Next, a response process procedure performed by the analysis system 400 according to the first embodiment will be described. FIG. 8 is a flowchart illustrating a response process performed by the analysis system 400 according to the first embodiment. As shown in FIG. 8, in the analysis system 400 according to the first embodiment, when the response processing unit 64 receives malware communication data (Yes in step S201), is the connection destination of the received malware communication data permitted? It is determined whether or not (step S202).

  If the connection destination is permitted (Yes at Step S202), the response processing unit 64 transmits malware communication data to the connection destination (Step S203). And the response process part 64 receives the response data with respect to the communication data of malware from a connection destination (step S204). Thereafter, the response processing unit 64 transfers the received response data to the malware execution unit 62 (step S205), and ends the process.

  On the other hand, when the connection destination is not permitted (No at Step S202), the response processing unit 64 generates response data corresponding to the communication data of the malware (Step S206). And the response process part 64 transfers the produced | generated response data to the malware execution part 62 (step S207), and complete | finishes a process.

[Effect of Example 1]
As described above, according to the first embodiment, in the analysis system including the analysis device that analyzes the behavior of the malicious program and the database that stores the information about the connection destination connected to the network, the malware execution unit 62 is included in the computer. Execute malware that performs illegal actions on Then, the connection determination unit 63 inquires the database 220 about information on a connection destination to which the malware executed by the malware execution unit 62 requests connection, and whether or not the connection destination is a connection destination permitted to communicate based on the result of the inquiry. Determine whether. Then, when the connection determination unit 63 determines that the connection destination is a connection destination permitted to communicate, the response processing unit 64 communicates with the connection destination and acquires a response to the malware. Therefore, the analysis system 400 according to the first embodiment does not perform communication when the connection destination is a regular connection destination, and can perform communication only when the connection destination is a malignant connection destination. It makes it possible to safely analyze the behavior of malware that requires a response.

  Further, according to the first embodiment, the connection determination unit 63 inquires of the database using the connection destination IP address or FQDN as the connection destination information, and when the IP address or FQDN is not stored in the database, It is determined that the connection destination is a connection destination for which communication is permitted. Therefore, the analysis system 400 according to the first embodiment can easily identify a malignant connection destination, and can easily realize a safe analysis of the behavior of malware that requires a response from the network.

  According to the first embodiment, when the connection destination IP address or the FQDN is stored in the database 220, the connection determination unit 63 further adds the number of other connection destinations related to the connection destination to the database. When the number of inquiries and other connection destinations is equal to or less than a predetermined threshold, it is determined that the connection destination in which the IP address or the FQDN is stored is a connection destination for which communication is permitted. Therefore, the analysis system 400 according to the first embodiment can make a fine determination regarding a malignant connection destination, and can increase the accuracy of the determination.

  Further, according to the first embodiment, the permission list storage unit 52 stores information related to connection destinations that are permitted in advance as a target of malware operation. And the connection determination part 63 determines with the said connection destination being the connection destination where communication was permitted, when the information regarding the connection destination requested | required by the malware was memorize | stored by the permission list memory | storage part 52. FIG. Therefore, the analysis system 400 according to the first embodiment can omit the processing related to the search, and can quickly perform the analysis.

  In addition, according to the first embodiment, the connection determination unit 63 stores information related to the connection destination in the database 220 and the number of other connection destinations related to the connection destination exceeds a predetermined threshold. Determines that the connection destination is a connection destination for which communication is not permitted. Then, when the connection determination unit 63 determines that the connection destination is a connection destination that is not permitted to communicate, the response processing unit 64 generates a response to the malware and transfers the generated response to the malware. Therefore, the analysis system 400 according to the first embodiment makes it possible to analyze malware that does not require connection with a network.

  Although the first embodiment has been described above, the present invention may be implemented in various different forms other than the first embodiment described above. Therefore, in the following, various different embodiments will be described by being divided into (1) to (7).

(1) Information of connection destination In the above-described first embodiment, the case where an IP address or FQDN is used as information regarding a connection destination has been described. However, the present embodiment is not limited to this. For example, a URL (Uniform Resource Locator) may be used as information regarding a connection destination. For example, when a URL is used, the permission list storage unit 52 stores a permission list of URLs that an analyst inputs in advance via the input unit 20 or communication is permitted in past analysis.

  Then, when receiving the URL requested by the malware, the connection determination unit 63 first determines whether or not the received URL is stored in the permission list storage unit 52. If the received URL is stored in the permission list storage unit 52, the connection destination is determined as a malignant connection destination. On the other hand, when the received URL is not stored in the permission list storage unit 52, the connection determination unit 63 transmits the received URL to the search server 200. Then, the connection determination unit 63 searches the URL transmitted to the search server 200.

  If the searched URL is not stored in the database 220, the connection determination unit 63 determines the connection destination as a malignant connection destination. On the other hand, when the searched URL is stored in the database 220, the connection determination unit 63 causes the search server 200 to further search the number of linked URLs. If the number of linked links is equal to or less than a predetermined threshold, the connection determination unit 63 determines the connection destination as a malignant connection destination. On the other hand, if the number of linked links exceeds a predetermined threshold, the connection determination unit 63 determines that the connection destination is a regular connection destination.

  As described above, the analysis system according to the present embodiment executes a connection destination determination process using a URL in addition to the IP address and the FQDN. Therefore, the analysis system according to the present embodiment can execute more detailed determination processing than when the IP address and the FQDN are used. For example, the analysis system according to the present embodiment can perform a determination process in which different connection destinations in the same host are distinguished.

(2) Search engine In the above-described first embodiment, the case where the connection destination is searched by one search engine has been described. However, the present embodiment is not limited to this, and for example, when a plurality of search engines are used. It may be. In such a case, it may be a case where a plurality of search results are collectively determined. For example, when the connection destination does not hit with a predetermined number of search engines among the plurality of search engines used for the search, the connection destination is determined as a malignant connection destination. Further, it may be a case where an arbitrary result is extracted from a plurality of search results and a determination is made based on the extracted result.

(3) Modified Example In the above-described first embodiment, the case of searching for the number of linked links using one search engine has been described. However, the present embodiment is not limited to this, for example, a plurality of search engines. May be used. FIG. 9 is a diagram showing a modification. FIG. 9 shows a search result obtained by executing a link search of “www.malware.com” in the search sites “AAA”, “BBB”, and “CCC”. The search site in FIG. 9 means a search engine used for the search. Further, the number of linked links in FIG. 9 means the number of other contents linked to the connection destination.

  For example, as shown in FIG. 9, the analysis system 400 performs a link search of “www.malware.com” and obtains a search result “search site: AAA, number of linked links: 2”. Similarly, as shown in FIG. 9, the analysis system 400 obtains a search result of “search site: BBB, number of linked links: 4”, “search site: CCC, number of linked links: 1”.

  Here, when the determination process regarding the number of linked links is executed, the determination may be made by comparing the total number of linked links hit at each search site with a predetermined threshold. Alternatively, the determination may be made by comparing the number of linked sites of the search site with the maximum number of linked links with a predetermined threshold.

(4) Determination Process In the above-described first embodiment, the example in which the determination process using the number of linked links is executed when the connection destination IP address or the FQDN is stored in the database 220 has been described. However, the present embodiment is not limited to this. For example, the determination process may be performed only by searching for the connection destination IP address or FQDN. That is, the determination process using the number of linked links may not be executed.

(5) Response processing In the above-described first embodiment, the case where the response processing unit 64 transfers the response data to the malware execution unit 62 has been described. However, the present embodiment is not limited to this, for example, The response data may not be transferred to the malware execution unit 62. For example, when communication with a connection destination is not permitted, the response processing unit 64 may not generate response data. Further, even when communication with the connection destination is permitted, the response processing unit 64 may not transfer the response data to the malware execution unit 62.

(6) System Configuration Each component of each illustrated device is functionally conceptual and does not necessarily need to be the same as the physically illustrated component. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the analysis data storage unit 51 and the permission list storage unit 52 illustrated in FIG. 1 may be integrated as one storage unit. On the other hand, the connection determination unit 63 shown in FIG. 1 may be distributed to a command execution unit that transmits a command to the search server 200 and a determination unit that executes a determination process based on the search result of the search server 200. Good.

  In addition, all or some of the processes described as being automatically performed among the processes described in the present embodiment can be manually performed. For example, it may be manually determined whether or not the connection destination in FIG. 8 is permitted. Further, the connection determination unit 63 may be connected as an external device of the analysis apparatus 100 via a network. Further, the function of the analysis system 400 described above may be realized by having the connection determination unit 63 included in another device and connected to and cooperated with a network. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

(7) Analysis Program In the first embodiment, the case where various processes are realized by hardware logic has been described. However, the present embodiment is not limited to this, and a program prepared in advance is executed by a computer. You may make it perform. In the following, an example of a computer that executes an analysis program having the same function as that of the analysis apparatus 100 described in the first embodiment will be described with reference to FIG. FIG. 10 is a diagram illustrating a computer that executes an analysis program.

  As shown in FIG. 10, the computer 1000 includes, for example, a memory 1010, a CPU (Central Processing Unit) 1020, and a hard disk drive interface 1030. As illustrated in FIG. 10, the computer 1000 includes, for example, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080. .

  As shown in FIG. 10, the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090 as shown in FIG. The disk drive interface 1040 is connected to the disk drive 1100 as shown in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. As shown in FIG. 10, the serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to a display 1130, for example, as shown in FIG.

  Here, as shown in FIG. 10, the hard disk drive 1090 stores, for example, an OS (Operating System), application programs, program modules, and program data. That is, the analysis program is stored, for example, on a hard disk as a program module in which a command executed by the computer 1000 is described. Specifically, an execution procedure for executing the same information processing as the malware execution unit 62 described in the above-described embodiment, a determination procedure for executing the same information processing as the connection determination unit 63, and the response processing unit 64 are the same. A program module describing a response processing procedure for executing the information processing is stored in the hard disk.

  Further, like the data stored in the permission list storage unit 52 described in the above-described embodiment, data used for information processing by the analysis program is stored as program data, for example, on a hard disk. Then, the CPU 1020 reads the program module and program data stored in the hard disk to the RAM 1012 as necessary, and executes the execution procedure, the determination procedure, and the response processing procedure.

  Note that the program module and program data related to the analysis program are not limited to being stored in the hard disk, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module and program data relating to the analysis program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the CPU 1020 via the network interface. It may be read out.

62 Malware Execution Unit 63 Connection Determination Unit 64 Response Processing Unit 100 Analysis Device 101, 102, 103 Connection Target 220 Database 300 Network 400 Analysis System

Claims (8)

An analysis system that includes an analysis device that analyzes the behavior of a malicious program and a database that stores information about connection destinations connected to a network,
Analysis device
Execution means for executing a malicious program that performs unauthorized operations in a computer;
A determination as to whether or not the connection destination is a connection destination that is permitted to communicate based on the result of the inquiry by querying the database for information on a connection destination to which a malicious program executed by the execution means requests connection. Means,
Response processing means for communicating with the connection destination and acquiring a response to the malicious program when the determination means determines that the connection destination is a connection destination permitted to communicate. Analysis system.   The determination means inquires the database of the connection destination address, FQDN or URL as the connection destination information, and communication is permitted for the connection destination when the address, FQDN or URL is not stored in the database. The analysis system according to claim 1, wherein the analysis system is determined to be a connected destination.   When the connection destination address, FQDN or URL is stored in the database, the determination means further inquires the database of the number of other connection destinations related to the connection destination, and the other connection destinations. 3. The method according to claim 1, wherein the connection destination storing the address, the FQDN, or the URL is determined to be a connection destination permitted to communicate when the number is less than or equal to a predetermined threshold. Analysis system described. A storage means for storing information related to a connection destination permitted in advance as an operation target of the malicious program;
The determination unit determines that the connection destination is a connection destination permitted to communicate when the storage unit stores information on the connection destination requested by the malicious program. Item 4. The analysis system according to any one of Items 1 to 3. When the information on the connection destination is stored in the database and the number of other connection destinations related to the connection destination exceeds a predetermined threshold, the determination unit communicates with the connection destination. Determine that the connection is not allowed,
The response processing unit generates a response to the malicious program and transfers the generated response to the malicious program when the determination unit determines that the connection destination is a connection destination that is not permitted to communicate. The analysis system according to any one of claims 1 to 3. Execution means for executing a malicious program that performs unauthorized operations in a computer;
A determination as to whether or not the connection destination is a connection destination that is permitted to communicate based on the result of the inquiry by querying an external database for information on the connection destination to which the malicious program executed by the execution means requests connection. Means,
A response processing unit configured to communicate with the connection destination and obtain a response to the malicious program when the determination unit determines that the connection destination is a connection destination permitted to communicate;
The analysis apparatus characterized by having. An execution step of executing a malicious program that performs an illegal operation in the computer;
Determination of whether or not the unauthorized program executed in the execution step queries an external database for information on a connection destination that requests connection, and determines whether or not the connection destination is a connection destination permitted to communicate based on the result of the inquiry Steps,
A response processing step of communicating with the connection destination and obtaining a response to the malicious program when the determination is made that the connection destination is a connection destination permitted to communicate;
The analysis method characterized by including. An execution procedure for executing a malicious program that performs an illegal operation in the computer;
A determination as to whether or not the connection destination is a connection destination permitted to communicate based on the result of the inquiry by querying an external database for information on the connection destination to which the malicious program executed by the execution procedure requests connection. Procedure and
If it is determined by the determination procedure that the connection destination is a connection destination permitted to communicate, a response processing procedure for communicating with the connection destination and obtaining a response to the malicious program;
An analysis program that is executed by a computer.

Images